HOw do I get rid of a trojan horse virus on computer?

Question

I ran ad ware, avg free edition anti virus, and search bot all found the trojan horse viruses. I deleted all the viruses but I still keep getting pop ups every 2 sec. I didn't have that yesterday before all the viruses. What else can I do to get rid of this trojan horse virus?

Answer 1

download FireFox.
It is more secure. this problem won't happen again with FF
http://www.mozilla.com/en-US/firefox/
as long as its just pop ups.

also try updating all those programs you mention. then run them again.

also get spybot.
http://www.safer-networking.org/
its a great program, but do updated it when you download it
run it and then it will want to restart the comp and run on its own again, to remove the virus from startup

Answer 2

Have you updated your spyware/virus protection lately? Go to the manufacturer that offers whatever virus protection you have and get the updates. They are usually free. DO NOT click on anything you see like "removes adware and spyware" from companies you don't recognize or from pop-ups. They are often forms of viruses themselves, even though they market as the solution to your problem they just cause you a lot more new problems.

Answer 3

You can delete that trojan horse, but if someone really determined to keep you out of chatrooms hacks your computer, there is nothing you can do about it. Forget your theraputic need to communicate and express yourself. Forget your pathetic little fun in life (chatrooms) they will make your life Hell. I speak from experience. You learn to live with it.

Answer 4

Udate your firewall and scan your coputer.After you remove virus trojan, I recommend you to use firefox browser. It can prevent viruses such as worm,trojan and etc.The newest official edition of firefox can be downloaded from http://www.mollzia.com/firefox-download.htm

Answer 5

I had same issue before 6 months. I went to Add/Remove programs and found a suspicious program installed in my computer and i removed using uninstaller. That resolved my problem. Hope it works for you.

Answer 6

For all computer related problems please check out
http://computer-probs.blogspot.com/
It not only gives complete solutions but also offers
free downloads of effective softwares which can detect
and eliminate all spy ware /virus /ad ware /Trojans completely.

Answer 7

download an AV-program and update. Then run a scan in safe mode and delete everything it finds.

Answer 8

You can find detail informations and the way of getting rid of it at http://www.fixit.in/antivirus.html

Answer 9

Next time for a better answer post the name of the Trojans and we can tell you the specific cleaner to delete them.

I have no doubt you are infected with a lot more than just these Trojans.
---------------------------------------------------------
Update your antivirus and run a full scan in safe mode

If you do not have full time (active) virus protection install (only one) all are excellent:

AVG Antivirus 7.5 Free Edition
http://free.grisoft.com/freeweb.php/doc/avg-anti-virus-free/lng/us/tpl/v5
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10669237.html?tag=lst-0-1
or
Free antivirus - avast! 4 Home Edition
http://www.avast.com/eng/avast_4_home.html
or
AOL Active Virus Shield
http://www.activevirusshield.com/antivirus/freeav/index.adp
---------------------------------------------------------
Install Windows Defender (full time spyware protection)
Perform a full scan.
http://www.microsoft.com/athome/security/spyware/software/default.mspx
---------------------------------------------------------
Install the following five programs and run weekly or at least monthly. You need all five. They will greatly increase your protection. They are not a substitute for full time spyware and virus protection.

Ad-Aware SE Personal (update + full scan)
http://www.lavasoftusa.com/products/ad-aware_se_personal.php

Spybot Search & Destroy (update + immunize + scan)
Do not enable Tea Timer and SDHelper
After installation: update + scan + immunize
http://www.safer-networking.org/en/mirrors/index.html

SpywareBlaster: Update then open and click “enable all protection”.
http://www.javacoolsoftware.com/spywareblaster.html

SUPERAntiSpyware free version: (update + scan)
http://www.superantispyware.com/

CCleaner: Do not install toolbar option
Removes tracking cookies, unneeded files, history
In options.
Set to run when computer starts.
Place cookies you want to keep in save list
http://www.ccleaner.com/
-------------------------------------------------------------
Note if a scan detects a problem but is unable to remove, start the computer in safe mode with the internet line disconnected and run a full scan.

In severe cases your system restore files will also be infected. In these cases you will need to turn off system restore to prevent malware hiding in the system restore files and reinfecting the computer during removal or during a future system restore. Turning off system restore deletes the system restore files.

Right click on "my computer"> Properties > System Restore Tab > Check box turn off system restore

After the malware is removed turn on system restore.
-------------------------------------------------------------
Run this time only

CWShredder: run
http://www.trendmicro.com/cwshredder/

Roguefix.bat
http://www.internetinspiration.co.uk/roguefix.htm#uninstall

Shoot The Messenger
http://www.grc.com/stm/shootthemessenger.htm

SmitFraudFix
http://www.geekstogo.com/forum/How_to_use_SmitFraudFix-t109268.html

Vundo Fix and
VirtumundoBegone (if VundoFix does not work)
http://www.bleepingcomputer.com/forums/topic18610.html

VX2 tool for Ad-Aware and run tool (Install and run)
http://www.lavasoftusa.com/support/securitycenter/vx2_cleaner.php

----------------------------------------------------------------------
Additional run this time and monthly.

Microsoft Update "Custom Mode" install everything
http://update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us

Microsoft OneCare Live, run “full service scan”
Updates windows, virus and spyware scan, disk cleanup, disk fragmentation (if needed), backs up registry and then cleans registry, and checks for open firewall ports
http://onecare.live.com/site/en-us/default.htm

Malicious Software Removal Tool (run “full scan”)
http://www.microsoft.com/security/malwareremove/default.mspx
-------------------------------------------------------
RootkitRevealer v1.71
http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspx

Rootkit Removal Guide
http://safecomputing.umn.edu/guides/scan_unhackme.html

Rootkits Removers
Pick any 2 install and run one each month

AVG Anti-Rootkit
http://www.grisoft.com/doc/products-avg-anti-rootkit-update-app-art/?ver=1.1.0.29

F-Secure BlackLight
http://www.f-secure.com/blacklight/

Sophos Anti-Rootkit
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html
----------------------------------------------------------
----------------------------------------------------------
Online Free Scanners:
Run Trend Micro, Kaspersky, and Panda Scan now.
Run a different one each month.

Trend Micro: HouseCall Free Scan (removes what it finds)
http://housecall.trendmicro.com/
BitDefender Online Scanner http://www.bitdefender.com/scan8/ie.html
Kaspersky Labs Online Scanner http://www.kaspersky.com/virusscanner
McAfee http://us.mcafee.com/root/mfs/default.asp?affid=294
Panda ActiveScan Free Online Scanner http://www.pandasoftware.com/products/activescan?
Symantic Online Scanner http://security.symantec.com/sscv6/ssc_eula.asp?langid=ie&venid=sym&plfid=23&pkj=ALUFRHYTINMHDKDCWLL&vc_scanstate=2
-------------------------------------------------------
Additional Information read:
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview
http://wiki.castlecops.com/Malware_Prevention:_Prevent_Re-infection
http://www.castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html
http://aumha.org/a/quickfix.htm
http://aumha.org/secure.htm
http://aumha.org/a/parasite.php
http://www.castlecops.com/t102301-Hijackthis_Guidelines_Read_Before_Posting.html
http://www.techsupportforum.com/security-center/hijackthis-log-help/15968-please-read-before-posting-
http://forum.aumha.org/viewtopic.php?t=4075&sid=901703d08c2ace31389ffef2d84b6607

Answer 10

Trojan Horse Attacks


If you were referred here, you may have been "hacked" by a Trojan horse attack. It's crucial that you read this page and fix yourself immediately. Failure to do so could result in being disconnected from the IRC network, letting strangers access your private files, or worst yet, allowing your computer to be hijacked and used in criminal attacks on others.

by Joseph Lo aka Jolo, with much help from countless others
This page is part of IRChelp.org's security section at http://www.irchelp.org/irchelp/security/
updated Feb 5, 2006

Contents:

* I. What is a Trojan horse?
* II. How did I get infected?
* III. How do I avoid getting infected in the future?
* IV. How do I get rid of trojans?!?
* Appendices

_____


I. What is a Trojan horse?


Trojan horse attacks pose one of the most serious threats to computer security. If you were referred here, you may have not only been attacked but may also be attacking others unknowingly. This page will teach you how to avoid falling prey to them, and how to repair the damage if you already did. According to legend, the Greeks won the Trojan war by hiding in a huge, hollow wooden horse to sneak into the fortified city of Troy. In today's computer world, a Trojan horse is defined as a "malicious, security-breaking program that is disguised as something benign". For example, you download what appears to be a movie or music file, but when you click on it, you unleash a dangerous program that erases your disk, sends your credit card numbers and passwords to a stranger, or lets that stranger hijack your computer to commit illegal denial of service attacks like those that have virtually crippled the DALnet IRC network for months on end.

The following general information applies to all operating systems, but by far most of the damage is done to/with Windows users due to its vast popularity and many weaknesses.

(Note: Many people use terms like Trojan horse, virus, worm, hacking and cracking all interchangeably, but they really don't mean the same thing. If you're curious, here's a quick primer defining and distinguishing them. Let's just say that once you are "infected", trojans are just as dangerous as viruses and can spread to hurt others just as easily!)

II. How did I get infected?


Trojans are executable programs, which means that when you open the file, it will perform some action(s). In Windows, executable programs have file extensions like "exe", "vbs", "com", "bat", etc. Some actual trojan filenames include: "dmsetup.exe" and "LOVE-LETTER-FOR-YOU.TXT.vbs" (when there are multiple extensions, only the last one counts, be sure to unhide your extensions so that you see it). More information on risky file extensions may be found at this Microsoft document.

Trojans can be spread in the guise of literally ANYTHING people find desirable, such as a free game, movie, song, etc. Victims typically downloaded the trojan from a WWW or FTP archive, got it via peer-to-peer file exchange using IRC/instant messaging/Kazaa etc., or just carelessly opened some email attachment. Trojans usually do their damage silently. The first sign of trouble is often when others tell you that you are attacking them or trying to infect them!

III. How do I avoid getting infected in the future?


You must be certain of BOTH the source AND content of each file you download! In other words, you need to be sure that you trust not only the person or file server that gave you the file, but also the contents of the file itself.

Here are some practical tips to avoid getting infected (again). For more general security information, please see our main security help page.

1. NEVER download blindly from people or sites which you aren't 100% sure about. In other words, as the old saying goes, don't accept candy from strangers. If you do a lot of file downloading, it's often just a matter of time before you fall victim to a trojan.
2. Even if the file comes from a friend, you still must be sure what the file is before opening it, because many trojans will automatically try to spread themselves to friends in an email address book or on an IRC channel. There is seldom reason for a friend to send you a file that you didn't ask for. When in doubt, ask them first, and scan the attachment with a fully updated anti-virus program.
3. Beware of hidden file extensions! Windows by default hides the last extension of a file, so that innocuous-looking "susie.jpg" might really be "susie.jpg.exe" - an executable trojan! To reduce the chances of being tricked, unhide those pesky extensions.
4. NEVER use features in your programs that automatically get or preview files. Those features may seem convenient, but they let anybody send you anything which is extremely reckless. For example, never turn on "auto DCC get" in mIRC, instead ALWAYS screen every single file you get manually. Likewise, disable the preview mode in Outlook and other email programs.
5. Never blindly type commands that others tell you to type, or go to web addresses mentioned by strangers, or run pre-fabricated programs or scripts (not even popular ones). If you do so, you are potentially trusting a stranger with control over your computer, which can lead to trojan infection or other serious harm.
6. Don't be lulled into a false sense of security just because you run anti-virus programs. Those do not protect perfectly against many viruses and trojans, even when fully up to date. Anti-virus programs should not be your front line of security, but instead they serve as a backup in case something sneaks onto your computer.
7. Finally, don't download an executable program just to "check it out" - if it's a trojan, the first time you run it, you're already infected!


IV. How do I get rid of trojans?!?


Here are your many options, none of them are perfect. I strongly suggest you read through all of them before rushing out and trying to run some program blindly. Remember - that's how you got in this trouble in the first place. Good luck!

1. Clean Re-installation: Although arduous, this will always be the only sure way to eradicate a trojan or virus. Back up your entire hard disk, reformat the disk, re-install the operating system and all your applications from original CDs, and finally, if you're certain they are not infected, restore your user files from the backup. If you are not up to the task, you can pay for a professional repair service to do it.

2. Anti-Virus Software: Some of these can handle most of the well known trojans, but none are perfect, no matter what their advertising claims. You absolutely MUST make sure you have the very latest update files for your programs, or else they will miss the latest trojans. Compared to traditional viruses, today's trojans evolve much quicker and come in many seemingly innocuous forms, so anti-virus software is always going to be playing catch up. Also, if they fail to find every trojan, anti-virus software can give you a false sense of security, such that you go about your business not realizing that you are still dangerously compromised. There are many products to choose from, but the following are generally effective: AVP, PC-cillin, and McAfee VirusScan. All are available for immediate downloading typically with a 30 day free trial. For a more complete review of all major anti-virus programs, including specific configuration suggestions for each, see the HackFix Project's anti-virus software page [all are ext. links]. When you are done, make sure you've updated Windows with all security patches [ext. link].

3. Anti-Trojan Programs: These programs are the most effective against trojan horse attacks, because they specialize in trojans instead of general viruses. A popular choice is The Cleaner, $30 commercial software with a 30 day free trial. To use it effectively, you must follow hackfix.org's configuration suggestions [ext. link]. When you are done, make sure you've updated Windows with all security patches [ext. link], then change all your passwords because they may have been seen by every "hacker" in the world.

4. IRC Help Channels: If you're the type that needs some hand-holding, you can find trojan/virus removal help on IRC itself, such as EFnet #dmsetup or DALnet #NoHack. These experts will try to figure out which trojan(s) you have and offer you advice on how to fix it. The previous directions were in fact adapted from advice given by EFnet #dmsetup. (See our networks page if you need help connecting to those networks.)